Enforce Binary Authorization for trusted GKE container image deployments

So wird geprüft

Prüfmethode: Shell-Befehl

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(binaryAuthorization.evaluationMode)') || exit 1
if case "$v" in PROJECT_SINGLETON_POLICY_ENFORCE|POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: binaryAuthorization.evaluationMode=$v"; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enable Binary Authorization enforcement on the GKE Standard cluster when the audit shows that the cluster is not using an enforcing evaluation mode. Use PROJECT_SINGLETON_POLICY_ENFORCE to enforce the project Binary Authorization policy. If the cluster also uses continuous validation with policy bindings, use POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE instead. Monitoring only modes should not be used as the remediation target for this control. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE Export the current Binary Authorization policy to a local YAML file. The trusted image deployment rules are edited in this policy file, not directly in the GKE cluster configuration.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target gke --level 2